A backup code is a one-time code you create in advance and keep somewhere safe. When two-step verification asks for a code and your phone or number is not available, you type a backup code instead. Google's are eight digits long and come in sets of ten; each works once.
What a backup code is
Two-step verification asks for something you know, your password, and something you have, usually your phone. A backup code is the paper version of the second part. It does not depend on a phone number, a signal or a particular device.
- Eight digits, ten per set, each one valid once.
- Steam
- A list of codes you enter instead of the one from the Steam Mobile app.
- When you use them
- A new phone, a lost phone, a changed number, or no signal abroad.
Where to find them (Google and others)
- Google: open 2-Step Verification In your Google Account, go to Security & sign-in → 2-Step Verification → Backup codes. 2-Step Verification has to be on.
- Google: get or refresh the set Click Get backup codes. Refresh makes a new set and the old one stops working at once.
- Google: find a downloaded set Search your computer for a file named Backup-codes- followed by your username.
- Steam: Manage Steam Guard Account Details → Manage Steam Guard → Get Backup Codes. Steam first texts a code to your phone, and e-mails you whenever codes are created or used.
Other services call them recovery codes, emergency codes or single-use codes. Look for them next to the two-step settings, right after you switch them on.
Storing them safely
- Print them and keep the page with your important documents. Google and Steam both suggest paper.
- No screenshots: Steam advises against them, and a photo of your codes travels wherever your photo library syncs.
- Never share them: a backup code is a full second factor, just like the code on your phone.
- Cross off used codes, and make a new set when only a few are left.
Backup codes vs. SMS vs. authenticator app
| Backup codes | SMS code | Authenticator app | |
|---|---|---|---|
| Needs your phone number | No | Yes | No |
| Needs mobile signal | No | Yes | No |
| After you change your number | Still work | Go to the old number until you update it | Still work |
| After you lose your phone | Still work, if stored elsewhere | Work once the number is on a new SIM | Only if the codes were synced or moved |
| How long a code lasts | Until used | A few minutes | About 30 seconds |
The usual advice: an authenticator app for every day, backup codes on paper for the bad day.
Temporary numbers have no place in this table: they close after one code, so they can never be your fallback. They are for one-off sign-up codes, where you do not want to hand out your own number.
Common questions
What is the 8-digit backup code for Google?
One of the ten single-use codes Google lets you create under 2-Step Verification → Backup codes. You type it instead of the code from your phone.
Can I reuse a backup code?
No. Each code works once and then becomes inactive.
I lost my backup codes. What now?
If you can still sign in, create a new set: the old codes stop working at once, so a lost list is no longer a risk.
Are backup codes safer than SMS?
They do not depend on your number, so a lost SIM or a changed number does not affect them. Their risk is the paper itself, so store it like a key.